Endesa customer breach exposed identity and bank details; over 16 million customers notified
Endesa notified over 16 million Endesa Energía and Energía XXI customers after unauthorised access to identity, contract and potentially IBAN details. Passwords were unaffected. Watch for impersonation scams and unfamiliar bank debits.
Treat unexpected calls, texts or emails claiming to be Endesa or Energía XXI cautiously, even if they know your contract details. Verify requests using the contact details on your bill before sharing personal or banking information. Check your bank account for unfamiliar debits and report any to your bank.
What’s happening
Endesa detected unauthorised access to systems holding customer information on 5 January 2026. Its customer notice identified contact details, identity numbers and energy-contract information, with bank account identifiers (IBANs) potentially included; passwords were unaffected. The company later disclosed that it notified just over 16 million customers of Endesa Energía and Energía XXI. Endesa said it blocked compromised access accounts, contained the intrusion and notified Spain’s data protection regulator, AEPD. Its initial statement said no fraudulent use was known at that time. On 26 January, Escudo Digital reported an alleged attacker’s claim to have published 300,000 records, while explicitly noting that their connection to this breach was not independently verified. Both affected companies supplied additional information to AEPD in February. As at 3 November, the sources reviewed did not establish a final regulatory outcome, charges, or confirmed recovery or deletion of the exposed data. There is no customer software update to install.
- What
- Breach
- Affects
- Endesa Energía and Energía XXI customer services
- Fixed in
- Nothing to patch
- Since
- 5 Jan 2026
- Closed
- 19 Feb 2026
Timeline
- Update
Energía XXI supplied further information requested by AEPD, following Endesa Energía’s response on 18 February. Endesa subsequently disclosed both responses in its first-quarter management report.
- Update
Escudo Digital reported that the alleged attacker claimed to have published 300,000 customer records while seeking negotiations with Endesa. The outlet said it could not independently verify that those records came from this breach.
- Update
Cadena SER reported that journalist Alberto Payo checked details supplied by the alleged attacker against his own Endesa contract and found they matched, including his bank account and identity number.
- Made public
Endesa publicly acknowledged access to customer identity, contact, contract and payment information. It said the intrusion had been contained, passwords were unaffected and it had no evidence of fraudulent use at that time.
- Update
After confirming on 8 January that Energía XXI was also affected, Endesa reported that company’s breach to AEPD. It decided to notify affected customers personally; its later filing put the notification total at just over 16 million.
- Update
Endesa notified Spain’s data protection regulator, AEPD, initially identifying Endesa Energía as the affected company.
- Made publicNothing to patch
Escudo Digital first reported the breach, according to Cadena SER’s subsequent account. Endesa later identified 5 January as the day it detected possible unauthorised access.
Sources
- Endesa Protección De Datos — customer breach noticeEndesa
- Consolidated management report for the three months ended 31 March 2026, section 5.3Endesa
- Endesa reports cyberattack affecting customer data, but says impact limitedSpain in English · 13 Jan 2026
- Historia del ataque a Endesa: un hacker presumido y 20 millones de clientes expuestosCadena SER · 17 Jan 2026
- El autor del hackeo a Endesa hace públicos datos de 300.000 clientesEscudo Digital · 26 Jan 2026
- Endesa dispara sus beneficios, pero hay otra cifra que retrata el malestar de sus clientesAndalucía Información · 2 Nov 2026